Is CVE-2026-50248 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50248 being exploited in the wild.

How severe is CVE-2026-50248?

Medium severity, with a CVSS score of 6.5, published 22 July 2026.

Which products and versions are affected?

NLnet Labs Unbound 1.7.0 to 1.25.1.

Is there a fix for CVE-2026-50248?

A patch was published on 2026-07-22: Fixed in Unbound version 1.25.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-50248 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-50248?

Check whether you run NLnet Labs Unbound at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50248: NLnet Labs Unbound insufficient verification of XFR endpoints in RPZ zones

CVE-2026-50248 · Severity: medium · CVSS 6.5 · Published 2026-07-22

Unbound is a widely used DNS resolver that helps translate human-readable website names into IP addresses. A security flaw allows an attacker to trick the system into accepting fake DNS records by spoofing the identity of a primary data source. This could allow an attacker to redirect network traffic or block access to legitimate websites by replacing the resolver's entire response policy.

Technologies: NLnet Labs Unbound. Vendors: NLnet Labs.

Quick answers

Is CVE-2026-50248 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50248 being exploited in the wild.
How severe is CVE-2026-50248?: Medium severity, with a CVSS score of 6.5, published 22 July 2026.
Which products and versions are affected?: NLnet Labs Unbound 1.7.0 to 1.25.1.
Is there a fix for CVE-2026-50248?: A patch was published on 2026-07-22: Fixed in Unbound version 1.25.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50248 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-50248?: Check whether you run NLnet Labs Unbound at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in Unbound's handling of authoritative (auth) and Response Policy Zones (RPZ) when a primary hostname resolves to a BOGUS DNSSEC state. Unbound incorrectly treats these BOGUS A/AAAA records as valid XFR endpoints. An attacker capable of spoofing these records (without needing a valid RRSIG) can position themselves as the primary XFR server. This allows the attacker to push a malicious zone transfer, effectively replacing the entire zone or response policy. The issue is fixed in version 1.25.2 by ensuring BOGUS hostnames are disregarded for XFR endpoints.

Affected products

NLnet Labs Unbound 1.7.0 to 1.25.1

Timeline

2026-07-22: advisory: NLnet Labs released advisory and patch for CVE-2026-50248
2026-07-22: patched: Fixed in Unbound version 1.25.2

References

https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50248.txt

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.